Converting Mellanox EMC switch to 
SX60xx 


Version v1.12 
Originally prepared by: dodgy route 


Please note, this is not a guide and should not be used by anyone, it is purely for my personal 
research purposes only. 


There is no warranty, support or anything implied, as you are not doing anything more than reading 
this document. 


If you use this document for something evil, hired goons will be dispatched at short notice to rectify 
the situation. 


About this document 

This document is a compilation of my own testing, learning from my mistakes and reading information 
from the EMC switch thread on STH which | will try to credit as much as possible. Thanks to mpogr for 
the initial guide on converting the switch, which this document is a complete replacement for, the 
process is nothing alike. He sparked the idea, leading to many people performing updates and 
progressing the document. 


The reason this is not an update to mpogr’s document is this process is entirely different to convert 
the switch to a plain Mellanox version. This document is based on my experience with the SX6012 but 
will ultimately work for SX6018 and SX6036. 


This allows one to then perform OS updates from the CLI or GUI, perform factory resets as well as run 
multiple images without worry of things breaking or not working ever. 


This information is available online in bits and pieces, all over the place, | merely compiled it into this 
document for myself. 


Document revision history 
2022.01.11 - v1.12 - dodgy route 


- As reported by arnbju in heading get current FRU, show devs does not work at this stage, | 
added to doco post conversion and | could not remember if it worked at the time, so now that 
it's confirmed its not working its removed 


2022.01.11 - v1.11 - dodgy route 


- Necrotyr has successfully confirmed the EMC to SX6018 FRU changeover works and followed 
guide to convert fine 

- Necrotyr has confirmed the document works on a previously converted SX6018 in fact, using 
mpogr’s notes 

- Reverted v1.10 changed back to MSX6018F-2SRS again post Necrotyr completing testing as 
the chassis is exactly that 


2022.01.10 - v1.10 - dodgy route 


- Fixed mistake for SX6018, had MSX6018F-2SRS for FRU, changed to MSX6018F-2SFS, air 
flowing out connector side 


2022.01.10 - v1.09 - dodgy route 


- Adding instructions for converting SX6018 with the help of Necrotyr who is hopefully going to 
test 


- Added copies of the FRU change script | modified, based entirely on SGS original scripts to 
cover SX6018 all versions, once testing done will leave only the EMC one 

- Modified Change FRU process to be more friendly for SX6012,SX6018 and SX6036 series 

- Added information to Get current FRU heading, was present in appendix but included for sake 
of clarity 

- Clarified PSID numbers for SX6012 and SX6018, do not have information yet for SX6036 


2022.01.06 - v1.08 - dodgy route 


- Created process for bootloader password disable on images version >= 3.6.5000 

- Clarified update process, image delete is only done once both partitions are updated 
- Clarified update process, image fetch is only done once both partitions are updated 
- Updated about this document description slightly 


2022.01.06 - v1.07 - dodgy route 


- Updated generate licences with info from andvalb for generating one license key with multiple 
licences activated 

- Updated genlicense topic with new single license key information for enabling ethernet 

- Updated loading licenses topic with new single license key information for enabling ethernet 


2022.01.05 - v1.06 - dodgy route 


- Updated manufacture switches to install bootloader that flashes Mellanox U-BOOT that enables 
the boot menu 

- Removed v1.05 section to add MLNX-OS boot menu manually using official process, now done 
during manufacture 

- Added Appendix 5 - Mellanox U-BOOT environment variables 

- Clarified the bootloader password will need to be removed on every image update if need 
bootloader/U-BOOT access 

- Clarified the bootloader password removal needs to be done from _ shell 


2022.01.04 - v1.05 - dodgy route 


- As per previous update, added section how to add MLNX-OS boot menu, the process fixes 
booting to partition 2 

- Added section how to remove bootloader password so can use boot menu 

- Added picture to last reboot step showing the CRC change as well as MLNX-OS boot menu 
availability 

- Finished updating the switch software image update process and pictures as that is now 
working correctly 


2022.01.04 - v1.04 - dodgy route 


- Added run boot_mIxlinux to switch preparation 

- Changed information about fan speed dropping on post conversion reboot to include actual 
percentages 

- Started adding information on upgrade process to bring converted switch up to latest version 

- Nota problem but definitely a nuisance, the update process is not booting to partition 2 
automatically, but the upgrade process works great, guessing remnant of EMC U-BOOT 
settings, trying to resolve but help is appreciated. Believe to be related is the switch does not 
present a menu to boot from which partition, so believe U-BOOT related 


2022.01.04 - v1.03 - dodgy route 


- Send the updated FRU to the switch heading, updated text to match reading FRU for bus 
number 
- Send the updated FRU to the switch heading, image MIA - now re-attached 


2022.01.04 - v1.02 - dodgy route 


- Clarify reboots are just commands run through the console 
- Crop picture in firmware upload 
- Change document revision history format 


2022.01.04 - v1.01 - dodgy route 


- Fix initial version date 
- Fix some text under download mfa_extract.py heading 


2022.01.03 - v1.00 - dodgy route 


- Initial version 


Pre requisites and preparation 
List of all required hardware and software for this learning exercise. Software is listed and 
configuration provided if needed. 


- Windows 10 machine, also tested via Linux, but process is same as this document, using Linux 
applications of course 

- Console cable to connect between switch and machine 

- Network cable to connect the Mellanox management port to an existing switch to access Win10 
machine’s network 

- Putty 

- Tftpd64 

- 7zip 

- Mellanox Firmware Tools (MFT) 

- Python 3 

- SwitchX software packages detailed in next section 


Windows 10 machine preparation 


ALL of these steps re required to be completed for conversion process as well as upgrading to latest 
MLNX-OS afterwards 


Install 7zip for Windows 
Link: https://www.7-zip.org/download.html 


Download and configure Uniform web server 
This is used to serve the images and various files needed for the conversion 


Link: https://www.uniformserver.com/ 


My link/version at the time of writing is: https://sourceforge.net/projects/miniserver/files/Uniform 
%20Server%20ZeroxlV/14 0 3 ZeroxlV/ 


This is a self-extracting 7zip archive, it is not an installer. Does not touch registry/etc 


On my desktop | have a Mellanox folder 


- Run the exe and select the Mellanox folder, should now have a UniServerZ folder in Mellanox 
folder 

- For the Uniform Server | have created web_share folder under Mellanox folder to serve files 
from 


[U] UniServer Zero XIV = x 
General Extra _Apache — MySQL PHP Perl About 
1 E :s2 ~~ Change Apache ports = 
© chnseontttter > — SA 
Edit Configuration Files > [|] Select new server Root-Folder (ssl) 
pe _ Edit Basic and Modules > Lo 
Apache Utilitie Z& Access and Passwords > 
Serve {2 Apache SSL > |Console 
€% Apache Vhosts > 
Vie Admin 
& Apache server Info - Status > 
: Q) Apache Logs > Ez 
| 3 
Docu @ Apache Syntax Check -t Ee 
| & Start-up pages > 


- Click Start Apache from the UniServer dialog 


NOTE: As per readme, x86 version of Visual C++ Redistributable for Visual Studio 2019 is required. 
May already be installed 


Link: https://support.microsoft.com/en-us/help/2977003/the-latest-supported-visual-c-downloads 


Download and configure Tftpd64 
Tftpd64 is used as a quick tftp and DHCP server. If there is DHCP in the network, no need to run the 
DHCP server 


Link: https://pjo2.github.io/tftpd64/ 


My link/version at the time of writing is: 


https://bitbucket.org/phjounin/tftpd64/downloads/tftpd64.464.zip 


On my desktop | have a Mellanox folder 


- Extract the zip to the Mellanox folder, should now have a tftpd64 folder in Mellanox folder 

- For the Tftpd64 server | have created tfpd_share folder under Mellanox folder to serve files 
from 

- Inthe tfpd_share folder | have a folder called “mlnx460ex” which must be lowercase as per this 
document 


In Tftpd64 set up the base directory as tfpd_share 


Current Directory 


Bp Tftpd64: Settings 


Server interfaces 


GLOBAL TFTP | DHCP| SYSLOG] DNS | 


Base Directory 


C:\Users\someone\Desktop\Mellanox\tfpd_share Browse | 


~ TFTP Security TFTP configuration 

( None Timeout [seconds] 3 

( Standard Max Retransmit ; 

™ High Titp port “ 

© Read Only local ports pool 
Advanced TFTP Options 

¥ Option negotiation 

[ PXE Compatibility 

I¥ Show Progress bar 


¥ Translate Unix file names 
[” Bind TFTP to this address 


ru au mia oe 1 


127.0.0.1 


Set up Firewall to accept inbound connections 
This is to set up Windows Defender Firewall with Advanced Security to allow connections to the Win10 
machine 


Add Uniform web server to firewall 
Add a new inbound rule to allow tcp port 80 to httpd_z.exe program on all profiles 


NOTE: Overwrite what is in the program path. The firewall does not understand the variable name, 
Microsoft problems.... 


Original path is put in as % USERPROFILE%\Desktop\Mellanox\UniServerZ\core\apache2\bin\ 
httpd_z.exe 


Change path to C:\Users\your_user_profile_ name\Desktop\Mellanox\UniServerZ\core\apache2\bin\ 
httpd_z.exe 


uniform web server allow Properties x 


Protocols and Ports Scope Advanced Local Principals # Remote Users 


General Programs and Services Remote Computers 
Programs 
re © All programs that meet the specified conditions 

@ This program: 


Browse. 


uniform web server allow Properties x 


General Programs and Services Remote Computers 
Protocols and Ports Scope Advanced Local Principals © Remote Users 
Protocols and ports 

— Protocol type: TCP v 

Protocol number: 6+ 

Local port: Specific Ports —_ 

Example: 80, 443, 5000-5010 
Remote port: All Ports bi 


Add Tftpd64 to firewall 
Add a new inbound rule to allow udp port 67 and 69 to tftpd64.exe program on all profiles 


NOTE: Overwrite what is in the program path. The firewall does not understand the variable name, 
Microsoft problems.... 


Original path is put in as % USERPROFILE%\Desktop\Mellanox\tftpd64\tftpd64.exe 
Change path to C:\Users\ your_user_profile_ name\Desktop\Mellanox\tftpd64\tftpd64.exe 


tftpd64 allow Properties x 


Protocols and Ports Scope Advanced Local Principals Remote Users 


General Programs and Services Remote Computers 
Programs 
| i| © Allprograms that meet the specified conditions 
@ This program: 
Desktop \Mellanox\tftp64\tftpd64.exe| | Browse... 
tftpd64 allow Properties x 
General Programs and Services Remote Computers 
Protocols and Ports Scope Advanced Local Principals © Remote Users 
Protocols and ports 
xg ~~ Protocol type: UDP v 
Protocol number: Wk 
Local port: Specific Ports v 
67,69 
Example: 80, 443, 5000-5010 
Remote port: All Ports — 


Download manufacturing environment 
Download the 3.2.0100 version software package 


Link: https://support.hpe.com/hpesc/public/swd/detail? 
switemld=MTX 93f9ad4836824db99c8d873d67 


From the downloaded file, extract the below files to the mlnx460ex directory and rename 


NOTE: Ensure in Windows folder options the “Hide extensions for known file types” is unchecked 
fdt-PPC_M460EX-SX_3.2.0100.img rename to fdt 

rootfs-PPC_M460EX-SX_3.2.0100.img rename to rootfs 

vmlinuz-PPC_M460EX-SX_3.2.0100.img rename to vmlinuz 


These files are needed for tftp to load up the manufacturing environment and my mlnx460ex folder 
looks like this 


€ v ® (4 > ThisPC >» Desktop >» Mellanox >» tfpd_share > minx460ex 
Name Date modified Type Size 
we Quick access _ 
| fdt 7/03/2012 7:41AM File 10 KB 
Bll Desktop # = = 2 
@| rootfs 1/03/2012 7:44 AM File 5,893 KB 
& Downloads 6) vmlinuz 7/03/2012 7:41AM File 1,820 KB 


Prepare switch software packages 
All of the below switch software packages need to be downloaded 


After downloading use 7zip and extract the .img file from each package to the web _ share folder, apart 
from 3.6.8012 


3.4.0012 link: https://support.hpe.com/hpesc/public/swd/detail? 
switemld=MTX_563eb88aa55a4495b6a30033al 


3.4.2008 link: https://support.hpe.com/hpesc/public/swd/detail? 
switemlId=MTX_6c8ee134228f4882ad517a3b4e 


3.5.1006 link: https://support.hpe.com/hpesc/public/swd/detail? 
switemld=MTX_1f7fc6ca8d2942b2b04bb82764 


3.6.3004 link: https://support.hpe.com/hpesc/public/swd/detail? 
switemlId=MTX_061c24a638b44bd2826c344823 


3.6.4006 link: https://support.hpe.com/hpesc/public/swd/detail? 
switemld=MTX_acc6f261080046aab9935cedbc 


3.6.5000 link: https://support.hpe.com/hpesc/public/swd/detail? 
switemId=MTX_df68447dc2f14228a9e5839641 


3.6.8010 link: https://support.hpe.com/hpesc/public/swd/detail? 
switemlId=MTX_flab10f1084d4bc795lalade5c 


3.6.8012 link: https://www.mellanox.com/downloads/Software/image-PPC_M460EX-3.6.8012.img 


Install and configure PuTTy 
This is used to access the console terminal of the switch 


Link: https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html 


My link/version at the time of writing is: https://the.earth.li/~sgtatham/putty/latest/w64/putty-64bit- 
0.76-installer.msi 


Find the COM port needed to use in PuTTy in the Windows device manager 


i Device Manager 
File Action View Help 
¢9\nm\O|\E |B 


3 Batteries 
(3) Computer 
we Disk drives 
G@® Display adapters 
fig Human Interface Devices 
sm IDE ATA/ATAPI controllers 
[3 Keyboards 
U) Mice and other pointing devices 
[9 Monitors 
@ Network adapters 
v &® Ports (COM & LPT) 
§@ USB-SERIAL CH340 (COM3) 
i Print queues 


Use this port in PuTTy, change the connection type to Serial and change COM1 to COM3 as per device 
manager. 


{8 PUTTY Configuration ? x 
Category: 

ey Session Basic options for your PUTTY session 

, Pin y Seat eae 

| je Keyboard = line 

| +» Features 

& Window ey oe ORlogin COSSH ©@ Serial 

: i. Annearance 


Install Python3 
Link: https://www.python.org/downloads/windows/ 


My link/version at the time of writing is https://www.python.org/ftp/python/3.10.1/python-3.10.1- 
amd64.exe 


Install Mellanox Firmware Tools (MFT) 
Link: https://www.mellanox.com/products/adapter-software/firmware-tools 


My link/version at the time of writing is 


https://www.mellanox.com/downloads/MFT/WinMFT_ x64 4 18 0 106.exe 


Prepare SX60xx firmware 


Extract firmware update 
Prepare firmware update based on image-PPC_M460EX-SX_3.4.0012.img as that is what we will 
manufacture with 


Open image-PPC_M460EX-SX_3.4.0012.img with 7zip and get into the base folder structure 


From the image extract file fw-SX-rel-9_3_1260-FIT.mfa which is in .\opt\tms\bin folder to the 
web share folder 


C:\Users\mario\Desktop\Mellanox\web_share\image-PPC_M460EX-SX_3.4.0012.img\image-SX_PPC_M460EX-ppc-m4...  — 


File Edit View Favorites Tools Help 


Fevyw»s»> xX i 


Add Extract Test Copy Move Delete 


Name 


i eetool 
| || fefd 


i fw_updt 
|_| genlicense 


0) fw-SX-rel-9_3_1260-FIT.mfa 


Info 


Size 

38 653 
4111011 
1 089 980 
3 948 880 
2 707 021 


Packed Size 
38 912 
4111 360 

1 090 048 

3 949 056 


2 707 456 


Download mfa_extract.py firmware extraction script 
This is created by a BeTeP on STH 


Link: https://github.com/BeTeP-STH/mft-scripts 


Direct link to script: https://raw.githubusercontent.com/BeTeP-STH/mft-scripts/master/mfa_extract.py 


Modified 

2014-12-16 09:00 
2014-12-16 09:02 
2014-12-16 09:01 
2014-12-16 09:02 
2014-12-16 09:00 


The scripts are backed up to Appendix 1 - mfa_extract.py 


| store mine in the web_share folder inside the Mellanox folder as the extracted file is generated there 


Change mfa_extract.py script 
Edit mfa_extract.py script, line 16, change from FLINT = “mstflint” to FLINT = “flint.bat” (quotes...) 


1 #!/usr/bin/python3 


# tested with 


Ne 


+ # mstflint -v 4 
5 # mstflint, mstflint 4.6.0. Git SHA Hash: 375120d - 
©c c 
7 import sys 7 
g import os g 
9 import subprocess 9 
10 import struct 10 
1l import zlib ll 
12 import lzma 12 
i import re 13 
14 import configparser 14 
is 15 
16 FLINT = "mstflin 16 


Get available firmware 
In regular user privileges PowerShell, the below commands will print the list of all firmware PSID 


available 


cd .\Desktop\Mellanox\web_share 


py .\mfa_extract.py .\fw-SX-rel-9_ 3 _1260-FIT.mfa | 


EX Windows PowerShell 


Mode User 
-rwxr-xr-x root 
-rwxr-xr-x root 

-Twxrwxrwx = root 
-rwxr-xr-x root 
-fwxr-x--- root 


#!/usr/bin/python3 


# tested with 
# mstflint -v 
# mstflint, mstflint 4. 


import sys 

import os 

import subprocess 
import struct 
import zlib 

import lzma 

import re 

import configparser 


MSX6@18F_A1 


3. MT_124011002@ 
+. MT_12401100629 
- MT_1240112029 
« MT_1246212620 
- MT_1250110001 
« MT_1260110027 
69. MT_1270110020 


SwitchX based FDR InfiniBand Switch; 18 QSFP; Managed 

d FDR-1@ InfiniBand Switch; 18 QSFP; Managed 

sed FDR-1@ InfiniBand Switch; 18 QSFP; Managed 
MSX6@18F - chX-2 based FDR InfiniBand Switch; 18 QSFP; Managed 
MTX61 i 1@km long haul FDR1@ InfiniBand switch; 6 long haul QSFP+ ports; Managed 
MSX Ax wi 2 based 36-port QSFP 4@GigE 1U Ethernet switch 
MSX6@012F_, FDR InfiniBand Switch; 12 QSFP ports; Managed ; Subnet Manager for 648 nodes 
MSX6@12 FDR1@ InfiniBand Switch; 12 QSFP ports; Managed ; Subnet Manager for 648 nodes 
MSX6012 FDR IB; 12 QSFP ports; Managed ; Subnet Manager for 648 nodes; P1-2 LR4 enabled 
MSX140@-B Ethernet Switch; 48-port SFP+ 1@GbE; 12 port QSFP 4@GbE; x86 CPU 
MSX67@@- 36-port QSFP FDR 1U Infiniband Switch; 6 CPU 
MSX17@@- -port QSFP 4@GbE 1U Ethernet Switch; x86 CPU 
MSX6@36 36-port QSFP S6GbE Managed InfiniBand to Ethernet gateway sy 
MSX1012 12-port QSFP+ 4@GbE ; 1U Ethernet switch 


h 


- MT_1270110029 
1. MT_1270111029 
- MT_1490110004 
. MT_150031002@ 
74. MT_150@310024 
+ MT_1530310031 
76. MT_1540110024 


NNNNN 


stem 
SwitchX-2 based 


We need the switch PSID, here is a list of PSID matched to switch model 
SX6012: MT_1270110020 (Line 69 in screenshot) 

SX6018: MT_1240212020 (Line 66 in screenshot) 

SX6036: Yet to be determined? 


Extract firmware .bin file 
After running the list command, change it as per below to extract using the needed PSID determined 
above for switch type 


SX6012: py .\mfa_extract.py .\fw-SX-rel-9_3_1260-FIT.mfa MT_1270110020 
SX6018: py .\mfa_extract.py .\fw-SX-rel-9_3_ 1260-FIT.mfa MT_1240212020 
SX6036: Yet to be determined? 


Windows PowerShell 


PS C:\Users\ \Desktop\Mellanox\web_share> -\mfa_extract.py .\fw-SX-rel-9_3_1260-FIT.mfa MT_1270110626 


FS2 failsafe image. Start address: @x@. Chunk size @x2@0000: 


NOTE: The addresses below are contiguous logical addresses. Physical addresses on 


flash may be different, based on the image start address and chunk size 


/@x@0000038-@x800013bb 
/@x@@0013bc -8x00002913 


(@x@01384)/ 
(@x@01558)/ 


(BOOT2) - OK 
(BOOT2) - OK 


/@x@0002914-8x80002a0b 
/@x@@002 a@c -Ox00002a4F 
/@x00002a50-8x8@8882b9b 
/@x@@0@2b9c -@x@8@@03b2F 
/@x@0003b30-0x00167843 
/@x@@167044-@0x00167a7F 
/@x@@167a80-0x0017319F 
/@x@@1731a0-@x001731cb 
/@x@@1731cc-@x00175673 
/@x@0000000-@x@0175673 


(@xeeeeFs) / 
(@x@00044 ) / 
(@x@0014c)/ 
(@x@@6F94 ) / 
(@x163514)/ 
(@x®@@@a3c)/ 
(@x@@b720)/ 
(@x@@@02c ) / 
(@x@024a8)/ 
(@x175674)/ 


(Configuration) - OK 
(GUID) - OK 

(Image Info) - OK 

(DDR) - OK 

(DDR) - OK 

(DDR) - OK 
(Configuration) - OK 
(Jump addresses) - OK 
(FW Configuration) - OK 
(Full Image) - OK 


-I- FW image verification succeeded. Image is bootable. 


mage type: FS2 
W Version: 
W Release Date: 
Device ID: 


Description: Node 


9.3.1260 
7.12.2014 
51000 


Portl Port2 Sys image 


eeeeeeeeeeeeeeee EEEeeeCeeEEEREEe BeEeCeeeeeeReRee eeEEeeEeeEOoReReeee 


n/a 


MT_1276110626 


eeeeeeeeoeRe eeeeeeeeeees 


This will leave a new .bin file in the web_share folder 


Rename it to MSX6012_9.3.1260.bin for later consumption, or something consistent to use in other 


commands in document 


EMC switch preparation 


Plug into switch console port and use putty or similar to connect to the terminal 
Boot up switch and in U-BOOT press any key when asked to stop the booting process 


At this stage take a backup of the environment variables, copy the output to a text file on the Win10 
machine 


printenv 


Use below commands to set up U-BOOT to be able to load the manufacturing environment 
setenv mfg_ramdisk_size 180224 

setenv mfg_extra_args ramdisk=262144 

setenv ipaddr 192.168.7.49 

setenv netmask 255.255.255.0 

setenv gatewayip 192.168.7.253 

setenv serverip 192.168.7.77 

setenv autostart no 

setenv autoload no 


run boot_mIxlinux (this also runs a saveenv, so no need to run it after executing this) 


Load manufacturing environment 
Provided the previous section is completed can then load up the manufacturing environment 


run mfg_nodhcp 


Once loaded this will ask to log in, simply entering root in the login field will let you log in to the Linux 
environment 


While in the manufacturing environment, | am going to deal with the ethernet and shell access 
licences 


This information is gathered from information in the EMC thread on how to get the license keys using 
nothing but the information available through the genlicense binary alone. Thanks to crash_maxed 
and lambdafunction 


Thanks to andvalb from STH for supplying the command on how to generate one license key with 
multiple licences activated 


These licenses appear to be generic and not tied to anything by the look of things, so are here for my 
own convenience 


It does look like it is possible to generate license keys for the switch specifically but | have not had 
time to experiment yet 


However, Appendix 3 - genlicense section on how to generate the licences 


Generic licence keys 
LK2-EFM_SX-5M11-5K11-5T11-88A1-BBDO-JP82-X - Enabled ethernet, L2 ethernet, L3 ethernet 
LK2-RESTRICTED_CMDS_GEN2-88A1-NEWD-BPNB-1 - Enables _shell command 


Remanufacture switch! 
This operation will configure the bootloader/U-BOOT to work with the 2 partitions, so can run 2 images 
at once. It will also flash the original Mellanox U-BOOT and reload completely fresh U-BOOT variables, 


all of the EMC variables will be gone at this point on the next reboot and the MLNX-OS menu will be 
functional as it is part of the non EMC branded U-BOOT 


/sbin/manufacture.sh -a -m ppc -B -u 


gp COM3 - PuTTY ~ 


Bee Tn Bee ie eo a eit ie il 


This step will take quite a while, it will be around 30 - 60 minutes and there is no progress indicators 
on the really slow parts when it gets to “Calling writeimage to image system” and “Calling imgverify 
to verify manufactured system” parts 


When the message “Manufacture done” displays, enter reboot and let it boot into MLNX-OS without 
any interaction 


EMC U-BOOT prior to the manufacturing operation U-BOOT on switch startup shows 
- U-Boot 2009.01 SX_PPC_M460EX SX_3.2.0330-82-EMC ppc (Feb 27 2013 - 12:13:42) 
Post manufacture with Mellanox U-BOOT 


- U-Boot 2009.01 SX_PPC_M460EX SX_3.2.0330-82 ppc (Dec 20 2012 - 17:53:54) 


A copy of the freshly built switch’s U-BOOT variables is in Appendix 5 - Mellanox U-BOOT environment 
variables 


Screenshot of boot post manufacture, showing new U-BOOT as well as the MLNX-OS boot menu 


NOTE: This reboot only will contain messages that CRC has changed due to U-BOOT being flashed to 
Mellanox version 


After the reboot we are greeted with the MLNX-OS prompt 
Login details are admin / admin 
After a little while it will prompt for the wizard to do initial setup 


After the wizard the configuration of the modules will take quite a while again. 


"configuration j 


Loading tn Cence 

Enter below commands after completion 

enable 

configure terminal 

license install LK2-EFM_SX-5M11-5K11-5T11-88A1-BBDO-JP82-X 
license install LK2-RESTRICTED_CMDS_GEN2-88A1-NEWD-BPNB-1 


configuration write 


First we need the script by SGS from Appendix 2 - FRU conversion scripts, go to the correct section 
for switch type 


Original link to where these originated from: 


This will convert the FRU from EMC to SX6012, SX6018 and SX6036. 
Testing has been successful on SX6012 and SX6018, but | do not have a SX6036 for testing on 


-aate tt ante TION «< 


This is created by a SGS on STH for SX6012 switches and | modified them for SX6018 and pending 
SX6036 


From terminal, remembering to change to the switch type we are dealing with, here | used 
emc_to_ 6012: 


_shell 
touch emc_to_6012 


vi emc_to_6012 


push i to insert text 


ge COMB - PuTTY 


Copy and paste the required switch model script from Appendix 2 - FRU conversion scripts, ensuring 
the quotes "" are correct 


Once finished making sure all the lines and starts and ends of lines are EXACTLY as per original, press 
ESC to exit insert mode 


COM3 - PuTTY 


To recheck the saved file, run the vi command again and this time SHIFT + : and type q! if no changes 
to exit without saving 


Get current FRU 
If converting from an earlier converted switch, the bus number may be different for the device bus 
number, going from 1 to 8, so we you may need to change the 1 to 8 if necessary 


/opt/tms/bin/mellaggra _read_fru 1 0x51 1000 fru_backplate.bin 


Convert exported FRU to SX60xx 
Run command to convert the FRU from EMC to SX60xx 


sh emc_to_6012 "fru_backplate.bin" "fru_patched.bin" 


1 backplate.bin" “fru patched.bin" 


Backup the original and new FRU to TFTP server 
Backup the fru files to server to have, just in case as well as for interest’s sake. This will store them in 
the Win10 machine 


tftp 192.168.7.77 -c put fru_backplate.bin 
tftp 192.168.7.77 -c put fru_patched.bin 


This copies the files to the root of the base Tftpd64 folder 


€ » 4h » ThisPC » Desktop » Mellanox » tfpd_share >» 
Name , Date modified Type Size 
we Quick access 
(BM Deskt @ minx460ex 01/2022 10:28PM File folde 
Bll Desktop - ~~ 
@| fru_backplate.bin 01/2022 10:26 PM 
@ Downloads | fru_patched.bin 01/2022 10:26PM BIN File 
@| Documents > 


Send the updated FRU to the switch 
Run command to send the converted SX60xx FRU to the switch, changing the device bus number 1 to 
only if needed. 


You should know which bus was used when exploring it from get current FRU step 


/opt/tms/bin/mellaggra _write_fru 1 0x51 1000 fru_patched.bin 


Firmware update 
This section details the change of the switch firmware from EMC to Mellanox 


Get the device path 
First we need to get the device 


mst status 


This tells us /dev/mst/mt51000_pciconf0 is the device we will be dealing with 


Ton} —_ 


Embedded I2C mas 


Embedded I2C mas 


Get current firmware information 
Lets get the current firmware information 


flint -override_cache_replacement -d /dev/mst/mt51000_pciconf0 q 


Ignore formatting that gets like that when pasted into console 


gp COM3 - PuTTY 


[admin@switch0Ol ~]# 


Backup EMC firmware 
flint -override_cache_replacement -d /dev/mst/mt51000_pciconf0 ri EMC-old.bin 


-W- Firmwar 


[admin@sx6012 


Verify old EMC firmware file 
flint -i EMC-old.bin q 


Backup firmware ini file 
This wont actually be used in the conversion process, but just nice to have as a backup 


flint -override_cache_replacement -d /dev/mst/mt51000_pciconf0 dc > EMC1270110020. ini 


Ignore formatting that gets like that when pasted into console 


tftp 192.168.7.77 -c put EMC1270110020. ini 


[admin@switchol 


[admin@switchOl ~ 


In the preparation steps | extracted the firmware image to the web share folder, it is now time to 
download it 


curl -O http://192.168.7.77/MSX6012_9.3.1260.bin 


~]# curl -O http 
+ Received + Xferc 


flint -i MSX6012_9.3.1260.bin q 


Flash new firmware to switch 


flint --override_cache_replacement --allow_psid_change -d /dev/mst/mt51000 _pciconfo -i 
./MSX6012_9.3.1260.bin b 


Ignore formatting that gets like that when pasted into console 


Get new/current firmware information 
Lets get the newly uploaded firmware information 


flint -override_cache_replacement -d /dev/mst/mt51000_pciconf0 q 
Ignore formatting that gets like that when pasted into console 
e cache replacement -d /dev/mst/mt51000 pcicon 
nabled. Running in this mode may cause the firmware to hang. 


ikipping full image integr 


MT 1270110020 
[admin@switch0Ol ~]# 


Remove the bootloader password so U-BOOT is accessible 


Thanks to necr from STH where | saw this 


Process for image versions under 3.6.5000 

NOTE: This operation will have to be performed on every new image update_if you need to get into 
the bootloader/U-BOOT, can skip the backup process. | did mine to test on 3.4.0012 and then when | 
installed 3.6.5000 which allowed to disable it. 


Log into _shell first using 
enable 
conf t 


_shell 


Backup the existing password, or view it using 


/opt/tms/bin/mddbreq /config/db/initial query get - /system/bootmgr/password 


Ignore formatting that gets like that when pasted into console 


The text is: $1$yCoib8pn$vSaWSssw2k17iOJRidmcw/ 


Remove the bootloader password 
/opt/tms/bin/mddbreq /config/db/initial set modify - /system/bootmgr/password string "' 
eetool -a bf -s UBPASSWD="" 


Verify the bootloader password is removed 


Using mlxi2c, from _shell 


mlxi2c show fru /CPU 


~]# mlxi2c show fru /CPU 


LOG: Initializing SX log w 


Process for image versions 3.6.5000 and above 
NOTE: This operation can be performed once and it should keep, | did mine when | updated to 
3.6.5000 which disables it 


enable 
configure terminal 


boot bootmgr password 7 "" 


write memory 


show bootvar 


ct 
ny 


Nm DN bo 
ct 
1] 

mM i fm 


7 of Db 


bo ww Ww 
ct 


This is it, enter reboot to.... reboot, and after that the switch conversion process is completed. 


The fans will ramp down quickly in two stages once the switch finishes loading up after the reboot, 
first to 60% and then 40%. 


gp COM - PuTTY 


Run the update process through the switch software packages detailed in Prepare switch software 
packages heading 


Rinse and repeat this, this is pulled from the recommended upgrade paths and based on available 
packages 


show images 


image delete <tab to autocomplete> 


NOTE: This is only done once both partitions are updated, don’t do this between partition updates as 
will need to re-download 


image fetch 


Note: This is only done once per image version and will allow you to perform update on both 
partitions 


seu SPSPPRPRARRESRAEREEEEREEEREEEEL, 
TTT TTT TT rTrrre rt rrri rererr rr et PHT eee FT |! 


SPSSLPELELERE EL 


show images 


Lal 


mh 
He oD oe AD ie LD ie bb 


FFTTTTF 


FFFsFFFFFFFFFFFF 


show images 


NOTE: the password still says it is set but it is nulled now, should be removable completely in a later 
3.6.Xxxx image 


On the reboot it will boot to partition 2 and you will be able to repeat the above steps again, to 
update partition 1 


After both partitions are updated, you can then move onto the next firmware version 


e 
© 
5 


oe Ww 
QQ 
to WW tet 


hy 


- 
> 


currently in progress 


show asic-version (from updated partition 2) 


This shows that the firmware was automatically updated to what is in MLNX-OS software image 
3.4.2008, which is 9.3.3180 


Appendix 


Appendix 1 - mfa_extract.py 
#!/usr/bin/python3 


# tested with 
# mstflint -v 
# mstflint, mstflint 4.6.0. Git SHA Hash: 375120d 


import sys 

import os 

import subprocess 
import struct 
import zlib 

import lzma 

import re 

import configparser 


FLINT = "flint.bat" 


def read buff(fn, n=-1): 
with open(fn, 'rb') as Ff: 
return f.read(n) 


def lzma_decompress (buf) : 
decomp = lLzma.LZMADecompressor (memLimit=0x10000000) 
try: 
return decomp.decompress (buf) 
except lzma.LZMAError: 
pass 
return b'' 


def save bin(fn, buff, bin off, bin len): 
decomp = Lzma.LZMADecompressor (memLimit=0x10000000) 
with open(fn, ‘wb') as f: 
try: 
f.write(decomp.decompress(buff) [bin off:bin off + bin len]) 
except Lzma.LZMAError: 
pass 
return decomp.eof 


def parse mtoc(buff, compressed, offset, size): 
mtoc = {} 
if compressed: 
off = 0 
while off < len(buff): 
a, b, c = struct.unpack from('>32sB1xH', buff, off) 
psid = a.decode('ascii').strip('\0') 
_, pn, _, desc = buff [off+40:off+180].decode('latin1l').strip('\0').split('\0') 
[0:4] 
mtoc[psid] = { 'pn': pn, ‘desc': desc, ‘off': [struct.unpack from('>IHH', buff, 
36+o0ff+c+40*i) for i in range(b)]} 
off += 36 +40 * bt+ec 
return mtoc 


def mfa_extract(mfaname, psid): 
SECTIONS = {} 
BUFFER = bytearray(read_ buff (mfaname) ) 
if b'MFAR' != BUFFER[0:4]: 
return 1 


off = 16 
for i in range(3): 
a,b,c,d = struct.unpack from('>B2xBI4s', BUFFER, off) 
off += 8 
SECTIONS[a] = {'offset': off, 'size': c, 'compressed': b and (d == b'\xFD7zX'), 
‘buff': memoryview(BUFFER[off:off+c]) } 
if SECTIONS[a]['compressed'] and i < 2: 
SECTIONS[a]['buff'] = lzma_decompress(SECTIONS[a]['buff']) 
off t= Cc 


MTOC = parse mtoc(**SECTIONS[1] ) 
if MTOC.get(psid): 
fn = "{}. bin". format (psid) 
for moff in MTOC[psid]['off']: 
off, size = struct.unpack from('>ii', SECTIONS[2]['buff'], moff[0]) 
if size > 0: 
break 
if save bin(fn, SECTIONS[3]['buff'], off, size): 
print(subprocess.check output([FLINT, '-i', fn, ‘'v']).decode('ascii')) 
print(subprocess.check output([FLINT, '-i', fn, 'q']).decode('ascii')) 
return 0 


else: 
for i, psid in enumerate(sorted(MTOC.keys()), 1): 
print('{i:>3}. {psid:15s}{pn:33s}{desc}'.format(i=i, psid=psid, **MTOC[psid])) 
return 0 
return 1 


if name == "— main": 
if len(sys.argv) != 3: 
print("Usage:\n\t{0} firmware.mfa <PSID>\t - to extract\n\t{0} firmware.mfa L|list\t - 
to list". format(*sys.argv) ) 
sys.exit(2) 
sys.exit(mfa_ extract(*sys.argv[1:])) 


Appendix 2 - FRU conversion scripts 
Check carefully for switch model, ie SX6012, SX6018 or SX6036 (upcoming) 


SX6012 


EMC SX6012 to MSX6012F-2BFS 
dd if=/dev/zero bs=16 count=256 of="$2" 2> /dev/null 


dd if="$1" bs=16 count=12 of="$2" conv=notrunc 2> /dev/null 
dd if="$1" bs=16 count=5 of="$2" skip=12 seek=14 conv=notrunc 2> /dev/null 


printf "\x20" | dd of="$2" bs=1 seek=1 count=1 conv=notrunc 2> /dev/null 
printf "\x00" | dd of="$2" bs=1 seek=5 count=1 conv=notrunc 2> /dev/null 


printf "\x05\xOE\x02\x14\x06\x16\x07" | dd of="$2" bs=1 seek=15 count=7 conv=notrunc 2> 
/dev/null 


printf "\x00\x1A\x00\x03\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ 
x00\x00\x00\x00\ x00\x00\x00\x00\x00\x00\x00" | dd of="$2" bs=1 seek=192 count=32 conv=notrunc 
2> /dev/null 

printf "\x00\x12\x00\x01\x06\x00\x00\x00\x00\x01\x00\x00\x02\x88\x04\x04\x02\x02\x00\x00\x00\ 
X00\x00\x00\x00\ x00\x00\x00\x00\x00\x00\x00\x00\x0A\ x00\x01\x07\x00\x00\x00\x00\x02\x10\x00\ 
x00\x00\x00\x00" | dd of="$2" bs=1 seek=320 count=48 conv=notrunc 2> /dev/null 


printf "\x4D\x53\x58\x36\x30\x31\x32\x46\x2D\x32\x42\x46\x53\x00" | dd of="$2" bs=1 seek=64 
count=14 conv=notrunc 2> /dev/null 


MSX6012F-2BFS to MSX1012F-2BFS 
if [ "$1" != "$2" ]; then 

dd if="$1" bs=16 count=256 of="$2" 2> /dev/null 
fi 


printf "\x4D\x53\x58\x31\x30\x31\x32\x42\x2D\x32\x42\x46\x53\x00" | dd of="$2" bs=1 seek=64 
count=14 conv=notrunc 2> /dev/null 

printf "\x03\xF4" | dd of="$2" bs=1 seek=162 count=2 conv=notrunc 2> /dev/null 

printf "\x31" | dd of="$2" bs=1 seek=166 count=1 conv=notrunc 2> /dev/null 

printf "\x06" | dd of="$2" bs=1 seek=329 count=1 conv=notrunc 2> /dev/null 


MSX1012F-2BFS to MSX6012F-2BFS 
if [ "$1" != "$2" ]; then 
dd if="$1" bs=16 count=256 of="$2" 2> /dev/null 
fi 
printf "\x4D\x53\x58\x36\x30\x31\x32\x46\x2D\x32\x42\x46\x53\x00" | dd of="$2" bs=1 seek=64 
count=14 conv=notrunc 2> /dev/null 
printf "\x17\x7C" | dd of="$2" bs=1 seek=162 count=2 conv=notrunc 2> /dev/null 
printf "\x36" | dd of="$2" bs=1 seek=166 count=1 conv=notrunc 2> /dev/null 
printf "\x01" | dd of="$2" bs=1 seek=329 count=1 conv=notrunc 2> /dev/null 


SX6018 


EMC SX6018 to MSX6018F-2SRS 
dd if=/dev/zero bs=16 count=256 of="$2" 2> /dev/null 


dd if="$1" bs=16 count=12 of="$2" conv=notrunc 2> /dev/null 
dd if="$1" bs=16 count=5 of="$2" skip=12 seek=14 conv=notrunc 2> /dev/null 


printf "\x20" | dd of="$2" bs=1 seek=1 count=1 conv=notrunc 2> /dev/null 
printf "\x00" | dd of="$2" bs=1 seek=5 count=1 conv=notrunc 2> /dev/null 


printf "\x05\xOE\x02\x14\x06\x16\x07" | dd of="$2" bs=1 seek=15 count=7 conv=notrunc 2> 
/dev/null 


printf "\x00\x1A\x00\x03\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ 
x00\x00\x00\x00\ x00\x00\x00\x00\x00\x00\x00" | dd of="$2" bs=1 seek=192 count=32 conv=notrunc 
2> /dev/null 

printf "\x00\x12\x00\x01\x06\x00\x00\x00\x00\x01\x00\x00\x02\x88\x04\x04\x02\x02\x00\x00\x00\ 
X00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0A\ x00\x01\x07\x00\x00\x00\x00\x02\x10\x00\ 
x00\x00\x00\x00" | dd of="$2" bs=1 seek=320 count=48 conv=notrunc 2> /dev/null 


printf "\x4D\x53\x58\x36\x30\x31\x38\x46\x2D\x32\x53\x52\x53\x00" | dd of="$2" bs=1 seek=64 
count=14 conv=notrunc 2> /dev/null 


Appendix 3 - genlicense 
Read genlicense encoded secret 
Thanks to lambdafunction 


From the switch image image-PPC_M460EX-SX_3.4.0012.img open the base folder and extract \opt\ 
tms\bin\genlicense 


Using Notepad++ or similar to explore the contents, search for autosupport where some interesting 
characters show up 


n&G@MGIRBOPENFLOW configurationM@@BMGBPuppet agent configurationMMMMBSuffer profile configuration MMSMGBMESMMBEULA conficgurationM@SMBBRoute-maps configurat 


.ath access-lists configuration@@GM@RMBIP community-lists 


ch* [pegaty sic hang GBpra* INULINULINULINU Lei Sig NOLINULINU LES SBi NULINULINULINUL ESS RINULINULINULINU Leese NULINULINU Late NUL stent NULINULINUL SRN UL etoile da 


ults.h,v l. 4 "2013/01/26 ee 39: 28 et Exp 


ft .mellanox. com i@aR@@tig—ent tp: / /AWESSUppPSEEt .mellanox.com/product/generic/v1_0/webpost.cqi MaMa MmaMea2 7 y5a5ks 


nt nt-core RIGS RES RIB vent s MER MERd ebug—modu 1 = RI Ris RIS RI s x — Sci LSS Misa x— daemonsM®@@protocol-— stack MMS ystem Management front-end componentsMM@@MGBSystem manag 


Interesting characters: z7y5a%5k4 


Decode interesting characters 
The characters are encoded in ROT18 which is a combination of ROT13 for letters and ROT5 for 
numbers 


Armed with this information and the interesting characters for the genlicense secret open 


https://cryptii.com/pipes/rot13-decoder and pick ROT18 
The secret turns out to be m2l0n%0x9 after decoding the ROT18 


Cryptii Help us build the next cryptii 


VIEW DECODE VIEW 


Ciphertext ~ ROT13 + Plaintext ~ 


z7ySa%sk4 m2 LOnN%OxS 


© ROT18 (0-9, A-Z, a-z) 


Generate licences 
From the manufacturing environment, genlicense commands can be used to generate ethernet and 
_shell licences, additional license keys can be generated as shown. 


Thanks to andvalb from STH for supplying the command on how to generate one license key with 
multiple licences activated 


Here is the commands | used to generate the licences for my experiment, note the secret that’s 
gained from genlicense binary 


/opt/tms/bin/genlicense 2 EFM_SX m210n%0x9 -o 53 true -o 51 true -o 58 true 
/opt/tms/bin/genlicense 2 RESTRICTED_CMDS_GEN2 m2l0n%0x9 


Appendix 4 - mlxi2c interesting dumps 
Some interesting information obtainable from mlxi2c command 


Get the device bus number 
This is needed for backing up and updating the FRU 


mlxi2c show devs -v 


On line FRU_EEPROM, Slv Addr 0x51, note the Bus Num, 8 in this case, this is where the emc_to_ 6012 
script works 


It appears the change in firmware moves it from Bus Num 1 on EMC firmware to Bus Num 8 when 
converted? 


Show MGMT FRU details 
mlxi2c show FRU MGMT 


ge COM3 - PuTTY 
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"MSX6012F-2BF5" 


wolf 


= yw ri? w 


td 
hy ff! 
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| 
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' 


Show CPU FRU details 
mlxi2c show fru /CPU 


gp COM3 - PuTTY 


This is froma freshly manufactured switch 


=> printenv 

bootdelay=5 

baudrate=9600 

loads echo= 

autoload=n 

hostname=mInx460ex 

netdev=ethO 

nfsargs=setenv bootargs root=/dev/nfs rw nfsroot=${serverip}:${rootpath } 
ramargs=setenv bootargs root=/dev/ram rw 


addip=setenv bootargs ${bootargs} ip=${ipaddr}:${serverip}:${gatewayip}:${netmask}:$ 
{hostname}:${netdev}:off panic=1 


addtty=setenv bootargs ${bootargs} console=ttyS0,${baudrate} 
addmisc=setenv bootargs ${bootargs} 

initrd_high=30000000 

kernel_addr_r=400000 

fdt_addr_r=800000 

ramdisk_addr_r=CO0000 


hostname=mInx460ex 


bootfile=mInx460ex/ulmage 

ramdisk_file=mInx460ex/uRamdisk 

rootpath=/opt/eldk/ppc_4xxFP 

flash_self=run ramargs addip addtty addmisc;bootm ${kernel_addr} ${ramdisk_addr} ${fdt_addr} 
flash_nfs=run nfsargs addip addtty addmisc;bootm ${kernel_addr} - ${fdt_addr} 


net_nfs=tftp ${kernel_addr_r} ${bootfile}; tftp ${fdt_addr_r} ${fdt_file}; run nfsargs addip addtty 
addmisc;bootm ${kernel_addr_r} - ${fdt_addr_r} 


net_self_load=tftp ${kernel_addr_r} ${bootfile};tftp ${fdt_addr_r} ${fdt_file};tftp ${ramdisk_addr_r} 
${ramdisk_file}; 


net_self=run net_self_load;run ramargs addip addtty addmisc;bootm ${kernel_addr_r} $ 
{ramdisk_addr_r} ${fdt_addr_r} 


fdt_file=mInx460ex/mInx460ex.dtb 
flash_self_old=run ramargs addip addtty addmisc;bootm ${kernel_addr} ${ramdisk_addr} 
flash_nfs_old=run nfsargs addip addtty addmisc;bootm ${kernel_addr} 


net_nfs_old=tftp ${kernel_addr_r} ${bootfile};run nfsargs addip addtty addmisc;bootm $ 
{kernel_addr_r} 


load=tftp 200000 mInx460ex/u-boot.bin 


update=protect off OxFFFAOOOO FFFFFFFF;era OxFFFAOOOO FFFFFFFF;cp.b ${fileaddr} OxFFFAOOOO $ 
{filesize};setenv filesize;saveenv 


upd=run load update 

dhcp_vendor-class-identifier=bootmfg:hwname:mInx460ex: 

clear_filesize=setenv filesize 

mfg_dir=m|Inx460ex 

mfg_args=setenv bootargs root=/dev/ram rw ramdisk_size=${mfg_ramdisk_size} ${mfg_extra_args} 
mfg_common_args=run addtty addmisc 


mfg_load=tftp ${kernel_addr_r} ${mfg_root}${mfg_dir}/${mfg_kernel_file};tftp ${fdt_addr_r} $ 
{mfg_root}${mfg_dir}/${mfg_fdt_file};tftp ${ramdisk_addr_r} ${mfg_root}${mfg_dir}/$ 
{mfg_ramdisk_file} 


mfg_nodhcp=echo "Manufacture will TFTP from directory ${mfg_root}${mfg_dir}, and boot";echo; 
run clear filesize ; run mfg_load;if test 0${filesize} -gt 0; then echo Booting mfg ; run mfg_args 
mfg_common_args;bootm ${kernel_addr_r} ${ramdisk_addr_r} ${fdt_addr_r} ; else ; echo Failed mfg 
load ; fi 


mfg=echo "Manufacture will DHCP, TFTP from directory ${mfg_root}${mfg_dir}, and boot";echo; 
dhcp; run clear filesize ; run mfg_load;if test 0${filesize} -gt 0; then echo Booting mfg ; run mfg_args 
mfg_common_args;bootm ${kernel_addr_r} ${ramdisk_addr_r} ${fdt_addr_r} ; else ; echo Failed mfg 
load ; fi 


menu_file=menu.img 


menu_load=tftp ${menu_addr_r} ${mfg_root}${mfg_dir}/${menu_file}; if test $? -ne 0; then run 
clear_filesize ; echo Download failed ;fi 


menu_usb_load_ext2=usb start; ext2load usb ${mfg_usb dev}:${mfg_usb part} ${menu_addr_r} $ 
{mfg_usb_root}${mfg_usb_ dir}/${menu_file}; 


menu_usb_load_fat=usb start; fatload usb ${mfg_usb dev}:${mfg_usb part} ${menu_addr_r} $ 
{mfg_usb_root}${mfg_usb_ dir}/${menu_file}; 


menu_usb_load=if test "x${mfg_usb_ fstype}" = "xext2"; then run menu_usb load _ext2 ; else ; run 
menu_usb _ load _ fat ; fi 


menu_usb=run clear filesize ; run menu_usb load ; if test O$ {filesize} -gt 0; then autoscr $ 
{menu_addr_r}; else ; echo Failed menu load ; fi 


menu_nodhcp=run clear _filesize ; run menu_load ; if test 0${filesize} -gt 0; then autoscr $ 
{menu_addr_r}; else ; echo Failed menu load ; fi 


menu=dhcp ; run clear filesize ; run menu_load ; if test 0$ {filesize} -gt 0; then autoscr $ 
{menu_addr_r}; else ; echo Failed menu load ; fi 


fw_file=u-boot.bin 


fw_load=tftp ${fw_addr_ r} ${mfg_root}${mfg_dir}/${fw_file}; if test $? -ne 0; then run 
clear_ filesize ; echo Download failed ;fi 


fw_usb load_ext2=usb start; ext2load usb ${mfg_usb dev}:${mfg_usb part} ${fw_addr_r} $ 
{mfg_usb_ root}${mfg_usb_ dir}/${fw_file}; 


fw_usb load_fat=usb start; fatload usb ${mfg_usb dev}:${mfg_usb_ part} ${fw_addr_r} $ 
{mfg_usb_ root}${mfg_usb dir}/${fw_file}; 


fw_usb_ load=if test "x${mfg_usb_ fstype}" = "xext2"; then run fw_usb load_ext2 ; else ; run 
fw_usb load fat; fi 


fw_update_raw=protect off OxFFFAOO00O FFFFFFFF;erase OxFFFAOOOO FFFFFFFF;cp.b ${fw_addr_r} 
OxFFFAO000 ${filesize};cmp.b ${fw_addr_r} OxFFFAOOOO ${filesize};setenv filesize; saveenv 


fw_usb update=run clear filesize ; run fw_usb load ; if test 0${filesize} -gt 0; then run fw_update_raw 
; else ; echo Failed update load ; fi 


fw_update_nodhcp=run clear filesize ; run fw_load ; if test 0${filesize} -gt 0; then run 
fw_update_raw ; else ; echo Failed update load ; fi 


fw_update=dhcp ; run clear filesize ; run fw_load ; if test 0${filesize} -gt 0; then run fw_update_raw ; 
else ; echo Failed update load ; fi 


boot_common_args=run addtty addmisc 
mfg_usb_dir=m|Inx460ex 


mfg_usb_load_ext2=usb start; echo "Loading ${mfg_kernel_file}";ext2load usb ${mfg_usb dev}:$ 
{mfg_usb_ part} ${kernel_addr_r} ${mfg_usb root}${mfg_usb_ dir}/${mfg_kernel_file};echo "Loading 
${mfg_fdt_file}"; ext2load usb ${mfg_usb dev}:${mfg_usb part} ${fdt_addr_r} ${mfg_usb_root}$ 
{mfg_usb_ dir}/${mfg_fdt_file};echo "Loading ${mfg_ramdisk_file}"; ext2load usb ${mfg_usb dev}:$ 
{mfg_usb_ part} ${ramdisk_addr_r} ${mfg_usb_ root}${mfg_usb_ dir}/${mfg_ramdisk_file} 


mfg_usb_load_fat=usb start; echo "Loading ${mfg_kernel_file}";fatload usb ${mfg_usb dev}:$ 
{mfg_usb_ part} ${kernel_addr_r} ${mfg_usb root}${mfg_usb_ dir}/${mfg_kernel_file};echo "Loading 
${mfg_fdt_file}"; fatload usb ${mfg_usb dev}:${mfg_usb part} ${fdt_addr_r} ${mfg_usb_ root}$ 
{mfg_usb_ dir}/${mfg_fdt_file};echo "Loading ${mfg_ramdisk_file}"; fatload usb ${mfg_usb_ dev}:$ 
{mfg_usb_ part} ${ramdisk_addr_r} ${mfg_usb root}${mfg_usb_ dir}/${mfg_ramdisk_file} 


mfg_usb_load=if test "x${mfg_usb fstype}" = "xext2"; then run mfg_usb_ load_ext2 ; else ; run 
mfg_usb_ load fat; fi 


mfg_usb=echo "Manufacture will load from USB directory ${mfg_usb_root}${mfg_usb dir}, and 
boot"; echo; run clear filesize ; run mfg_usb_ load; if test 0${filesize} -gt 0; then echo Booting mfg ; 
run mfg_args mfg_common_args;bootm ${kernel_addr_r} ${ramdisk_addr_r} ${fdt_addr_r} ; else; 
echo Failed mfg load ; fi 


fw_addr_r=400000 
menu_addr_r=B00000 
pciconfighost=1 


pcie_mode=RP:RP 
autoload=no 


boot_usb_ext2_loc_1=run usb_args loc_1 boot_common_args;echo "Loading $ 
{boot_kernel_file}";ext2load usb ${boot_usb dev}:${boot_usb part_loc_1} ${kernel_addr_r} $ 
{boot_usb_root}${boot_usb_ dir}/${boot_kernel_file};echo "Loading ${boot_fdt_file}";ext2load usb $ 
{boot_usb dev}:${boot_usb_part_loc_1} ${fdt_addr_r} ${boot_usb root}${boot_usb_dir}/$ 
{boot_fdt_file};bootm ${kernel_addr_r} - ${fdt_addr_r} 


boot_usb_ext2_loc_2=run usb_args loc_2 boot_common_args;echo "Loading $ 
{boot_kernel_file}";ext2load usb ${boot_usb dev}:${boot_usb part_loc_ 2} ${kernel_addr_r} $ 
{boot_usb_root}${boot_usb_ dir}/${boot_kernel_file};echo "Loading ${boot_fdt_file}";ext2load usb $ 
{boot_usb dev}:${boot_usb_part_loc 2} ${fdt_addr_r} ${boot_usb root}${boot_usb_ dir}/$ 
{boot_fdt_file};bootm ${kernel_addr_r} - ${fdt_addr_r} 


boot_usb_fat_loc_1=run usb args loc_1 boot_common_args;echo "Loading $ 
{boot_kernel_file}";fatload usb ${boot_usb dev}:${boot_usb part_loc_1} ${kernel_addr_r} $ 
{boot_usb_root}${boot_usb_ dir}/${boot_kernel_file};echo "Loading ${boot_fdt_file}";fatload usb $ 
{boot_usb dev}:${boot_usb_part_loc_1} ${fdt_addr_r} ${boot_usb root}${boot_usb_ dir}/$ 
{boot_fdt_file};bootm ${kernel_addr_r} - ${fdt_addr_r} 


boot_usb_fat_loc_2=run usb args loc_2 boot_common_args;echo "Loading $ 
{boot_kernel_file}";fatload usb ${boot_usb dev}:${boot_usb part_loc 2} ${kernel_addr_r} $ 
{boot_usb_root}${boot_usb dir}/${boot_kernel_file};echo "Loading ${boot_fdt_file}";fatload usb $ 
{boot_usb dev}:${boot_usb_part_loc 2} ${fdt_addr_r} ${boot_usb root}${boot_usb_ dir}/$ 
{boot_fdt_file};bootm ${kernel_addr_r} - ${fdt_addr_r} 


mfg_kernel_file=vmlinuz 
mfg_ramdisk_file=rootfs 
mfg_ramdisk_size=180224 
mfg_fdt_file=fdt 
mfg_usb_dev=0 
mfg_usb_part=1 
mfg_usb_fstype=fat 
mfg_usb_root=/ 
boot_kernel_file=vmlinuz 
boot_fdt_file=fdt 

boot_usb dev=0 
boot_usb_part_loc_1=2 
boot_usb_part_loc 2=3 
boot_usb_root_loc_1=/dev/sda5 
boot_usb_root_loc_2=/dev/sda6 


usb_args loc_1=setenv bootargs root=${boot_usb_ root_loc_1} ro reset_button=${reset_button} 
rootdelay=8 ${image_ kernel_args} ${extra_args} 


usb_args loc_2=setenv bootargs root=${boot_usb_ root_loc_2} ro reset_button=${reset_button} 
rootdelay=8 ${image_ kernel_args} ${extra_args} 


jffs2_args=setenv bootargs root=${rootdev} rootfstype=jffs2 ro reset_button=${reset_button} $ 
{image_kernel_args} ${extra_args} 


flash_jffs2=run jffs2_args boot_common_args;bootm ${kernel_addr} - ${fdt_addr} 


ethaddr=F4:52:14:CA:CC:3A 
ethladdr=F4:52:14:CA:CC:3B 

stdin=serial 

stdout=serial 

stderr=serial 

reset_button=0 

ethact=ppc_4xx_eth0O 

ver=U-Boot 2009.01 SX_PPC_M460EX SX_3.2.0330-82 ppc (Dec 20 2012 - 17:53:54) 
bm_mfgmenu_allowed=0 

bm_netboot_allowed=0 

pn=SA002203 

hwname=M460EX 

location=1 

kernel_addr=Oxff000000 

ramdisk_addr=- 

fdt_addr=Oxffle0000 

image _kernel_args= img_id=1 quiet loglevel=4 panic=1 
rootdev=/dev/mtdblock6 


bootcmd=run flash_jffs2 


Environment size: 9023/16380 bytes 


